// the take
QM is a self-hosted, multi-tenant agent platform for companies: every employee and every Slack channel/project gets its own scoped memory, files, permissions, and sandbox, with a shared core that can run different models and agent harnesses (Pi, Claude Code) behind one identity. It's aimed at infra/platform teams standing up an internal "company agent" for a whole org, not at an individual wanting a personal assistant.
The security model is unusually concrete for this category: three enforced tool-approval postures (Strict/Auto/Dangerous), a separate content-screening dial (off/observe/enforce) that's independent of the approval posture, and a predeclared command policy with hard denials (e.g. recursive deletes) that still applies even under Dangerous. Harness and model are genuinely pluggable behind one core rather than hardcoded to a vendor, and memory can be routed per-scope to external providers while keeping a built-in notebook as fallback. The deployment story treats fork-and-customize as a first-class problem — a separate deployment directory/repo pins the package version, and `update-qm` is designed to merge upstream changes while preserving local customizations without squashing commit ancestry.
There's no production deployment CI included — the README says init "does not generate or enable deployment CI, and this repository has no production deployment workflow," so you're building your own release pipeline from scratch. Session durability is opt-in and silent: without `DATABASE_URL` and `SESSION_STORE=postgres` set, sessions live in process memory and quietly vanish on restart, an easy way to lose a first eval's state. Contributions are only accepted as prose proposals in `adrs/*.md`, not code — fine as a philosophy, but it means there's no real PR path for outside bug fixes, everything funnels through the maintainers. And running it for real means standing up several coupled services (core, web UI/admin, portal/auth broker, Slack plugin, per-scope sandboxes, Postgres) — this is infra-heavy from day one, not something you casually trial.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →